React2Shell - CVE-2025-55182 + CVE-2025-66478
1 min read
Apr 24, 2026
This is the follow-up to the HackIndex exploitation write-up. React2Shell is an unauthenticated pre-auth RCE in the React Server Components (RSC) Flight protocol. The Next.js CVE (CVE-2025-66478) tracks the downstream impact on App Router deployments and is treated as a merged/duplicate of the upstream React CVE.
The only meaningful “protect” here is patching. Everything else is delay tactics.
Pull the lab and start it
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/HackIndex-io/React2Shell-CVE-2025-55182
┌──(kali㉿kali)-[~]
└─$ cd React2Shell-CVE-2025-55182
┌──(kali㉿kali)-[~]
└─$ docker compose up --build --force-recreate
This brings up the Next app on :3000 and SSH on :2222.
SSH in with webadmin account
Password: TrainingPassword123!
┌──(kali㉿kali)-[~]
└─$ ssh [email protected] -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
Patch from inside the container
You’re going to stop the Next process, upgrade the vulnerable packages, rebuild .next, then start again under Supervisor.
f8ec5ff15a51 ~$ cd /app # Change to the web app directory
f8ec5ff15a51 ~$ npm audit # Check for issues
f8ec5ff15a51 ~$ supervisorctl stop next # Stop the web app
f8ec5ff15a51 ~$ npm audit fix --force # Fix the security issues
f8ec5ff15a51 ~$ rm -rf .next # Nuke .next and rebuild
f8ec5ff15a51 ~$ npm run build # Rebuild the web app
f8ec5ff15a51 ~$ supervisorctl start next # Start the web app
Those are the repo’s intended mitigation steps.
Was this helpful?
Your feedback helps improve this page.